INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.5' (ECDSA) to the list of known hosts. 2018/04/02 19:30:58 fuzzer started 2018/04/02 19:30:59 dialing manager at 10.128.0.26:44347 syzkaller login: [ 30.808323] can: request_module (can-proto-0) failed. [ 30.817194] can: request_module (can-proto-0) failed. 2018/04/02 19:31:02 kcov=true, comps=true 2018/04/02 19:31:02 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x20000802, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080)=0x4, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xfff, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr}, 0x10) 2018/04/02 19:31:02 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:02 executing program 7: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0xd1, &(0x7f0000000ffc)=0xfd, 0x4) 2018/04/02 19:31:02 executing program 3: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) 2018/04/02 19:31:02 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:02 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) capset(&(0x7f00001e4ff8)={0x20020071026}, &(0x7f0000001fe8)) sendmsg$nl_xfrm(r0, &(0x7f0000001680)={&(0x7f00000001c0)={0x10}, 0xc, &(0x7f0000001640)={&(0x7f00000004c0)=@polexpire={0xc0, 0x1b, 0x709, 0x0, 0x0, {{{@in=@broadcast=0xffffffff, @in6}}}}, 0xc0}, 0x1}, 0x0) 2018/04/02 19:31:02 executing program 5: r0 = socket$inet(0x2, 0x840000000003, 0x2) setsockopt$inet_int(r0, 0x0, 0x40008000000d2, &(0x7f0000000040), 0xb3) 2018/04/02 19:31:02 executing program 6: r0 = socket$inet(0x2, 0x80002, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xe2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x541b, &(0x7f0000000000)={'ip6gre0\x00'}) [ 31.776971] IPVS: ftp: loaded support on port[0] = 21 [ 31.835521] IPVS: ftp: loaded support on port[0] = 21 [ 31.871404] IPVS: ftp: loaded support on port[0] = 21 [ 31.908303] IPVS: ftp: loaded support on port[0] = 21 [ 31.979650] IPVS: ftp: loaded support on port[0] = 21 [ 32.047071] IPVS: ftp: loaded support on port[0] = 21 [ 32.148160] IPVS: ftp: loaded support on port[0] = 21 [ 32.257235] IPVS: ftp: loaded support on port[0] = 21 [ 33.753434] ip (4841) used greatest stack depth: 17016 bytes left [ 34.142809] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 34.204555] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 34.233238] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 34.353783] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 34.385197] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 34.517741] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 34.682283] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 34.798934] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 38.105939] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 38.112101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.246598] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 38.252729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.294548] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 38.300682] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.344826] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 38.350987] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.388803] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 38.395113] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.518894] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.551538] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 38.557659] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.634528] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.684478] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.695698] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.741790] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 38.747942] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.799406] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.908719] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 38.914834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.952517] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.963190] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 38.969745] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.983397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.060652] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.066891] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.077886] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.104656] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 39.115953] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.122732] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.134280] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.153830] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.169816] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready 2018/04/02 19:31:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) [ 39.199896] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/04/02 19:31:10 executing program 3: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) [ 39.270959] capability: warning: `syz-executor1' uses deprecated v2 capabilities in a way that may be insecure [ 39.299688] syz-executor0 (5793) used greatest stack depth: 16184 bytes left 2018/04/02 19:31:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:10 executing program 3: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) [ 39.343348] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.349737] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.361158] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.388185] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 39.505765] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.512671] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.527950] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.599134] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.605411] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.622856] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/04/02 19:31:10 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x20000802, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080)=0x4, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xfff, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr}, 0x10) 2018/04/02 19:31:10 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) capset(&(0x7f00001e4ff8)={0x20020071026}, &(0x7f0000001fe8)) sendmsg$nl_xfrm(r0, &(0x7f0000001680)={&(0x7f00000001c0)={0x10}, 0xc, &(0x7f0000001640)={&(0x7f00000004c0)=@polexpire={0xc0, 0x1b, 0x709, 0x0, 0x0, {{{@in=@broadcast=0xffffffff, @in6}}}}, 0xc0}, 0x1}, 0x0) 2018/04/02 19:31:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:10 executing program 3: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) 2018/04/02 19:31:10 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:10 executing program 7: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0xd1, &(0x7f0000000ffc)=0xfd, 0x4) 2018/04/02 19:31:10 executing program 5: r0 = socket$inet(0x2, 0x840000000003, 0x2) setsockopt$inet_int(r0, 0x0, 0x40008000000d2, &(0x7f0000000040), 0xb3) 2018/04/02 19:31:10 executing program 6: r0 = socket$inet(0x2, 0x80002, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xe2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x541b, &(0x7f0000000000)={'ip6gre0\x00'}) [ 39.660530] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.666748] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.673802] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/04/02 19:31:10 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) capset(&(0x7f00001e4ff8)={0x20020071026}, &(0x7f0000001fe8)) sendmsg$nl_xfrm(r0, &(0x7f0000001680)={&(0x7f00000001c0)={0x10}, 0xc, &(0x7f0000001640)={&(0x7f00000004c0)=@polexpire={0xc0, 0x1b, 0x709, 0x0, 0x0, {{{@in=@broadcast=0xffffffff, @in6}}}}, 0xc0}, 0x1}, 0x0) 2018/04/02 19:31:10 executing program 7: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0xd1, &(0x7f0000000ffc)=0xfd, 0x4) 2018/04/02 19:31:10 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x20000802, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080)=0x4, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xfff, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr}, 0x10) 2018/04/02 19:31:11 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:11 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x20000802, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080)=0x4, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xfff, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr}, 0x10) 2018/04/02 19:31:11 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:11 executing program 6: r0 = socket$inet(0x2, 0x80002, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xe2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x541b, &(0x7f0000000000)={'ip6gre0\x00'}) 2018/04/02 19:31:11 executing program 5: r0 = socket$inet(0x2, 0x840000000003, 0x2) setsockopt$inet_int(r0, 0x0, 0x40008000000d2, &(0x7f0000000040), 0xb3) 2018/04/02 19:31:11 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x20000802, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080)=0x4, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xfff, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr}, 0x10) 2018/04/02 19:31:11 executing program 7: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0xd1, &(0x7f0000000ffc)=0xfd, 0x4) 2018/04/02 19:31:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) capset(&(0x7f00001e4ff8)={0x20020071026}, &(0x7f0000001fe8)) sendmsg$nl_xfrm(r0, &(0x7f0000001680)={&(0x7f00000001c0)={0x10}, 0xc, &(0x7f0000001640)={&(0x7f00000004c0)=@polexpire={0xc0, 0x1b, 0x709, 0x0, 0x0, {{{@in=@broadcast=0xffffffff, @in6}}}}, 0xc0}, 0x1}, 0x0) 2018/04/02 19:31:11 executing program 5: r0 = socket$inet(0x2, 0x840000000003, 0x2) setsockopt$inet_int(r0, 0x0, 0x40008000000d2, &(0x7f0000000040), 0xb3) 2018/04/02 19:31:11 executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:11 executing program 6: r0 = socket$inet(0x2, 0x80002, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xe2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x541b, &(0x7f0000000000)={'ip6gre0\x00'}) 2018/04/02 19:31:11 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:11 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x20000802, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080)=0x4, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xfff, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr}, 0x10) 2018/04/02 19:31:11 executing program 1: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) 2018/04/02 19:31:11 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:11 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x20000802, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080)=0x4, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xfff, 0x0, &(0x7f00000002c0)={0x2, 0x0, @rand_addr}, 0x10) 2018/04/02 19:31:11 executing program 5: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) 2018/04/02 19:31:11 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 1: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) 2018/04/02 19:31:11 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:11 executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:11 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 1: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) 2018/04/02 19:31:11 executing program 5: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) 2018/04/02 19:31:11 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 5: msgrcv(0x0, &(0x7f00000000c0)={0x0, ""/4081}, 0xff7f, 0x0, 0x5243970b5a5d5f53) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001140)='/dev/sequencer2\x00', 0x210140, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000001180)={0x3, 0x3ff, 0x1, 0x0, 0x11}) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x0) r2 = accept4$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @hyper}, 0x10, 0x80800) syz_open_dev$sndtimer(&(0x7f0000001100)='/dev/snd/timer\x00', 0x0, 0x40) getpeername(r0, &(0x7f00000013c0)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001440)=0x80) bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xa, 0xb, &(0x7f0000001200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}, [@generic={0x10001, 0x8, 0x40, 0x3}, @map={0x18, 0x0, 0x1, 0x0, r1}, @alu={0x4, 0x1, 0x3, 0x1, 0x5, 0x20, 0xfffffffffffffff0}, @map={0x18, 0x5, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000001280)='syzkaller\x00', 0x1776, 0xc7, &(0x7f00000012c0)=""/199, 0x40f00, 0x1, [], r3}, 0x48) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f00000010c0)={0x7f}, 0x4) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x4) 2018/04/02 19:31:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 1: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:11 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 7: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x10ad}, 0x2c) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xc, 0x5, &(0x7f0000346fc8)=@framed={{0x18}, [@alu={0x7, 0x0, 0x1}], {0x95}}, &(0x7f0000000000)='syzkaller\x00', 0x5c6e, 0x362b, &(0x7f0000000000)=""/251}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe, 0x84, &(0x7f0000000340)="4e77582ae86bc806202d7ead41a4", &(0x7f0000000400)=""/132}, 0x28) 2018/04/02 19:31:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 5: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) 2018/04/02 19:31:11 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f000090cfed)='/dev/snd/controlC#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xf9a000)=nil, 0xf9a000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000b09ffc)) 2018/04/02 19:31:11 executing program 7: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x104e21}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f000000a000)={@broadcast=[0xff, 0xe0, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) 2018/04/02 19:31:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) 2018/04/02 19:31:11 executing program 5: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) [ 40.611120] FAT-fs (loop1): Directory bread(block 112) failed [ 40.643732] FAT-fs (loop1): Directory bread(block 113) failed 2018/04/02 19:31:11 executing program 6: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) 2018/04/02 19:31:11 executing program 4: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) 2018/04/02 19:31:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(cast6)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003bcfd0)="d3ab27191a01002356ba602dff05000bfef9b9d2a4b20079fffffffffffffe00", 0x20) sendmmsg$alg(r1, &(0x7f0000002c80)=[{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f0000000200)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) writev(r1, &(0x7f0000000580)=[{&(0x7f0000000400)="0edf51535e86051d10f244844fbc57b50c0c4a55e2b24c6d23519a5446b9c08a4a2b45b6e924dfcfdea1a9afde2db770", 0x30}], 0x1) recvmsg(r1, &(0x7f0000158000)={&(0x7f00002fffa0)=@nfc_llcp, 0x5c, &(0x7f0000000000)=[{&(0x7f000080f000)=""/4096, 0x1000}], 0x1, &(0x7f0000da2000)}, 0x0) [ 40.665323] FAT-fs (loop1): Directory bread(block 114) failed 2018/04/02 19:31:11 executing program 6: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) 2018/04/02 19:31:11 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f000090cfed)='/dev/snd/controlC#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xf9a000)=nil, 0xf9a000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000b09ffc)) [ 40.738247] FAT-fs (loop1): Directory bread(block 112) failed [ 40.764410] FAT-fs (loop1): Directory bread(block 113) failed [ 40.837130] FAT-fs (loop1): Directory bread(block 114) failed 2018/04/02 19:31:12 executing program 1: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:12 executing program 7: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x104e21}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f000000a000)={@broadcast=[0xff, 0xe0, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) 2018/04/02 19:31:12 executing program 6: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) 2018/04/02 19:31:12 executing program 3: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:12 executing program 5: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) 2018/04/02 19:31:12 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f000090cfed)='/dev/snd/controlC#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xf9a000)=nil, 0xf9a000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000b09ffc)) 2018/04/02 19:31:12 executing program 2: socket$key(0xf, 0x3, 0x2) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) 2018/04/02 19:31:12 executing program 4: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) [ 40.885808] FAT-fs (loop1): Directory bread(block 112) failed [ 40.891893] FAT-fs (loop1): Directory bread(block 113) failed [ 40.898907] FAT-fs (loop1): Directory bread(block 114) failed 2018/04/02 19:31:12 executing program 5: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) 2018/04/02 19:31:12 executing program 7: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x104e21}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f000000a000)={@broadcast=[0xff, 0xe0, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) 2018/04/02 19:31:12 executing program 6: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:12 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f000090cfed)='/dev/snd/controlC#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xf9a000)=nil, 0xf9a000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000b09ffc)) 2018/04/02 19:31:12 executing program 4: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040)='a', 0x1}]) [ 40.992174] FAT-fs (loop3): Directory bread(block 112) failed [ 41.018883] FAT-fs (loop3): Directory bread(block 113) failed [ 41.045224] FAT-fs (loop3): Directory bread(block 114) failed 2018/04/02 19:31:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) [ 41.119872] FAT-fs (loop1): Directory bread(block 112) failed [ 41.146699] FAT-fs (loop1): Directory bread(block 113) failed [ 41.167936] FAT-fs (loop3): Directory bread(block 112) failed [ 41.175468] FAT-fs (loop1): Directory bread(block 114) failed [ 41.191131] FAT-fs (loop3): Directory bread(block 113) failed [ 41.196471] FAT-fs (loop6): Directory bread(block 112) failed [ 41.234414] FAT-fs (loop6): Directory bread(block 113) failed [ 41.235794] FAT-fs (loop3): Directory bread(block 114) failed [ 41.256092] FAT-fs (loop5): Directory bread(block 112) failed [ 41.260304] FAT-fs (loop6): Directory bread(block 114) failed [ 41.275431] FAT-fs (loop5): Directory bread(block 113) failed [ 41.283458] FAT-fs (loop1): Directory bread(block 112) failed [ 41.290609] FAT-fs (loop3): Directory bread(block 112) failed [ 41.296636] FAT-fs (loop1): Directory bread(block 113) failed [ 41.302856] FAT-fs (loop5): Directory bread(block 114) failed [ 41.308872] FAT-fs (loop3): Directory bread(block 113) failed [ 41.315133] FAT-fs (loop1): Directory bread(block 114) failed [ 41.316362] FAT-fs (loop3): Directory bread(block 114) failed [ 41.331635] FAT-fs (loop1): Directory bread(block 112) failed [ 41.338943] FAT-fs (loop6): Directory bread(block 112) failed [ 41.344674] FAT-fs (loop5): Directory bread(block 112) failed [ 41.349434] FAT-fs (loop6): Directory bread(block 113) failed [ 41.351591] FAT-fs (loop5): Directory bread(block 113) failed [ 41.356965] FAT-fs (loop1): Directory bread(block 113) failed [ 41.369583] FAT-fs (loop6): Directory bread(block 114) failed [ 41.375555] FAT-fs (loop5): Directory bread(block 114) failed [ 41.376720] FAT-fs (loop5): Directory bread(block 112) failed [ 41.388150] FAT-fs (loop1): Directory bread(block 114) failed [ 41.394916] FAT-fs (loop6): Directory bread(block 112) failed [ 41.397185] FAT-fs (loop5): Directory bread(block 113) failed [ 41.407471] FAT-fs (loop6): Directory bread(block 113) failed [ 41.407548] FAT-fs (loop5): Directory bread(block 114) failed [ 41.419179] FAT-fs (loop6): Directory bread(block 114) failed 2018/04/02 19:31:12 executing program 7: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x104e21}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f000000a000)={@broadcast=[0xff, 0xe0, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) 2018/04/02 19:31:12 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x104e21}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f000000a000)={@broadcast=[0xff, 0xe0, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) 2018/04/02 19:31:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:12 executing program 1: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:12 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) 2018/04/02 19:31:12 executing program 2: socket$key(0xf, 0x3, 0x2) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) 2018/04/02 19:31:12 executing program 6: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:12 executing program 3: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:12 executing program 7: socket$key(0xf, 0x3, 0x2) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) [ 41.694894] FAT-fs (loop1): Directory bread(block 112) failed [ 41.703194] FAT-fs (loop3): Directory bread(block 112) failed [ 41.719133] FAT-fs (loop3): Directory bread(block 113) failed [ 41.720226] FAT-fs (loop6): Directory bread(block 112) failed [ 41.725266] FAT-fs (loop1): Directory bread(block 113) failed [ 41.731294] FAT-fs (loop5): Directory bread(block 112) failed 2018/04/02 19:31:12 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x104e21}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f000000a000)={@broadcast=[0xff, 0xe0, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) [ 41.737689] FAT-fs (loop3): Directory bread(block 114) failed [ 41.748377] FAT-fs (loop6): Directory bread(block 113) failed [ 41.756367] FAT-fs (loop5): Directory bread(block 113) failed [ 41.775007] FAT-fs (loop1): Directory bread(block 114) failed 2018/04/02 19:31:12 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) 2018/04/02 19:31:12 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x104e21}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f000000a000)={@broadcast=[0xff, 0xe0, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) [ 41.806108] FAT-fs (loop6): Directory bread(block 114) failed [ 41.822800] FAT-fs (loop5): Directory bread(block 114) failed 2018/04/02 19:31:13 executing program 2: socket$key(0xf, 0x3, 0x2) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) [ 41.915954] FAT-fs (loop3): Directory bread(block 112) failed [ 41.926180] FAT-fs (loop1): Directory bread(block 112) failed [ 41.945314] FAT-fs (loop6): Directory bread(block 112) failed [ 41.952361] FAT-fs (loop3): Directory bread(block 113) failed [ 41.958811] FAT-fs (loop1): Directory bread(block 113) failed [ 41.975745] FAT-fs (loop6): Directory bread(block 113) failed [ 41.978788] FAT-fs (loop3): Directory bread(block 114) failed [ 41.989153] FAT-fs (loop1): Directory bread(block 114) failed [ 41.989172] FAT-fs (loop5): Directory bread(block 112) failed [ 41.998327] FAT-fs (loop1): Directory bread(block 112) failed [ 42.011359] FAT-fs (loop6): Directory bread(block 114) failed [ 42.012655] FAT-fs (loop3): Directory bread(block 112) failed [ 42.034824] FAT-fs (loop1): Directory bread(block 113) failed [ 42.037525] FAT-fs (loop6): Directory bread(block 112) failed [ 42.045636] FAT-fs (loop3): Directory bread(block 113) failed [ 42.053287] FAT-fs (loop6): Directory bread(block 113) failed [ 42.058373] FAT-fs (loop1): Directory bread(block 114) failed [ 42.067047] FAT-fs (loop6): Directory bread(block 114) failed [ 42.071232] FAT-fs (loop3): Directory bread(block 114) failed [ 42.075232] FAT-fs (loop5): Directory bread(block 113) failed 2018/04/02 19:31:13 executing program 1: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:13 executing program 7: socket$key(0xf, 0x3, 0x2) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) 2018/04/02 19:31:13 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) 2018/04/02 19:31:13 executing program 6: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:13 executing program 2: socket$key(0xf, 0x3, 0x2) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) 2018/04/02 19:31:13 executing program 3: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) 2018/04/02 19:31:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200077000f801", 0x17}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000000080)='./file0/file0\x00', 0x3fffa, 0x0) r0 = open(&(0x7f0000000280)='./file0/file0\x00', 0x4001, 0x0) fallocate(r0, 0x1, 0x6522, 0x3) [ 42.115134] FAT-fs (loop5): Directory bread(block 114) failed [ 42.124669] FAT-fs (loop5): Directory bread(block 112) failed [ 42.132225] FAT-fs (loop5): Directory bread(block 113) failed [ 42.138268] FAT-fs (loop5): Directory bread(block 114) failed 2018/04/02 19:31:13 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) [ 42.295006] FAT-fs (loop6): Directory bread(block 112) failed [ 42.296643] FAT-fs (loop5): Directory bread(block 112) failed [ 42.306607] FAT-fs (loop1): Directory bread(block 112) failed [ 42.330355] FAT-fs (loop3): Directory bread(block 112) failed 2018/04/02 19:31:13 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) 2018/04/02 19:31:13 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) [ 42.340157] FAT-fs (loop6): Directory bread(block 113) failed [ 42.356478] FAT-fs (loop6): Directory bread(block 114) failed [ 42.357397] FAT-fs (loop1): Directory bread(block 113) failed [ 42.367292] FAT-fs (loop5): Directory bread(block 113) failed [ 42.380943] FAT-fs (loop3): Directory bread(block 113) failed 2018/04/02 19:31:13 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) [ 42.406703] FAT-fs (loop5): Directory bread(block 114) failed [ 42.407404] FAT-fs (loop3): Directory bread(block 114) failed 2018/04/02 19:31:13 executing program 7: socket$key(0xf, 0x3, 0x2) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) [ 42.457348] FAT-fs (loop1): Directory bread(block 114) failed [ 42.503161] FAT-fs (loop6): Directory bread(block 112) failed 2018/04/02 19:31:13 executing program 4: futex(&(0x7f000000cffc), 0x800000000005, 0x0, &(0x7f0000920000)={0x0, 0xfffffffffffffffc}, &(0x7f0000d58ffc), 0x4000000) [ 42.543551] FAT-fs (loop3): Directory bread(block 112) failed [ 42.554126] FAT-fs (loop6): Directory bread(block 113) failed [ 42.564428] FAT-fs (loop5): Directory bread(block 112) failed [ 42.581919] FAT-fs (loop6): Directory bread(block 114) failed [ 42.583268] FAT-fs (loop1): Directory bread(block 112) failed 2018/04/02 19:31:13 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) 2018/04/02 19:31:13 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) [ 42.590345] FAT-fs (loop5): Directory bread(block 113) failed [ 42.605737] FAT-fs (loop3): Directory bread(block 113) failed [ 42.623587] FAT-fs (loop6): Directory bread(block 112) failed [ 42.635272] FAT-fs (loop1): Directory bread(block 113) failed 2018/04/02 19:31:13 executing program 4: futex(&(0x7f000000cffc), 0x800000000005, 0x0, &(0x7f0000920000)={0x0, 0xfffffffffffffffc}, &(0x7f0000d58ffc), 0x4000000) [ 42.643593] FAT-fs (loop5): Directory bread(block 114) failed [ 42.651125] FAT-fs (loop1): Directory bread(block 114) failed [ 42.658794] FAT-fs (loop6): Directory bread(block 113) failed [ 42.664648] FAT-fs (loop3): Directory bread(block 114) failed [ 42.668755] FAT-fs (loop5): Directory bread(block 112) failed [ 42.677410] FAT-fs (loop1): Directory bread(block 112) failed [ 42.701286] FAT-fs (loop6): Directory bread(block 114) failed [ 42.703520] FAT-fs (loop3): Directory bread(block 112) failed [ 42.713259] FAT-fs (loop5): Directory bread(block 113) failed [ 42.713633] FAT-fs (loop1): Directory bread(block 113) failed [ 42.731217] FAT-fs (loop5): Directory bread(block 114) failed 2018/04/02 19:31:13 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000265ff7)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x227a, &(0x7f0000000000)) 2018/04/02 19:31:13 executing program 7: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x0) close(r0) 2018/04/02 19:31:13 executing program 4: futex(&(0x7f000000cffc), 0x800000000005, 0x0, &(0x7f0000920000)={0x0, 0xfffffffffffffffc}, &(0x7f0000d58ffc), 0x4000000) 2018/04/02 19:31:13 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fafff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x0, 0x4}]}) 2018/04/02 19:31:13 executing program 1: r0 = socket(0x10, 0x803, 0x0) ioctl$sock_ifreq(r0, 0x8931, &(0x7f0000001440)={'syz_tun\x00', @ifru_mtu=0x7ff}) [ 42.755153] FAT-fs (loop1): Directory bread(block 114) failed [ 42.768233] FAT-fs (loop3): Directory bread(block 113) failed [ 42.795108] FAT-fs (loop3): Directory bread(block 114) failed 2018/04/02 19:31:14 executing program 1: r0 = socket(0x10, 0x803, 0x0) ioctl$sock_ifreq(r0, 0x8931, &(0x7f0000001440)={'syz_tun\x00', @ifru_mtu=0x7ff}) 2018/04/02 19:31:14 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(poly1305-simd,ctr-camellia-asm)\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x0) 2018/04/02 19:31:14 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f000095bffc), 0x4) r2 = fcntl$dupfd(r1, 0x0, r0) sendto$inet6(r2, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x9, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x1c) 2018/04/02 19:31:14 executing program 4: futex(&(0x7f000000cffc), 0x800000000005, 0x0, &(0x7f0000920000)={0x0, 0xfffffffffffffffc}, &(0x7f0000d58ffc), 0x4000000) 2018/04/02 19:31:14 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000265ff7)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x227a, &(0x7f0000000000)) 2018/04/02 19:31:14 executing program 7: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x0) close(r0) 2018/04/02 19:31:14 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000ee1fa8)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000b78ff0), 0x0) 2018/04/02 19:31:14 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xa, 0x200, 0x9392, 0x51, 0x0, 0x1}, 0x2c) 2018/04/02 19:31:14 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xa, 0x200, 0x9392, 0x51, 0x0, 0x1}, 0x2c) 2018/04/02 19:31:14 executing program 1: r0 = socket(0x10, 0x803, 0x0) ioctl$sock_ifreq(r0, 0x8931, &(0x7f0000001440)={'syz_tun\x00', @ifru_mtu=0x7ff}) 2018/04/02 19:31:14 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000ee1fa8)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000b78ff0), 0x0) [ 43.042303] protocol 0000 is buggy, dev ip6tnl0 [ 43.047313] ================================================================== [ 43.054781] BUG: KASAN: use-after-free in skb_release_data+0x16a/0x790 [ 43.061444] Write of size 4 at addr ffff8801c71eb160 by task syz-executor2/6302 [ 43.068882] [ 43.070513] CPU: 0 PID: 6302 Comm: syz-executor2 Not tainted 4.16.0+ #11 [ 43.077343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.086684] Call Trace: 2018/04/02 19:31:14 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xa, 0x200, 0x9392, 0x51, 0x0, 0x1}, 0x2c) [ 43.089266] dump_stack+0x1a7/0x27d [ 43.092896] ? arch_local_irq_restore+0x53/0x53 [ 43.097558] ? show_regs_print_info+0x18/0x18 [ 43.102052] ? kasan_check_write+0x14/0x20 [ 43.106284] ? skb_release_data+0x16a/0x790 [ 43.110603] print_address_description+0x73/0x250 [ 43.115444] ? skb_release_data+0x16a/0x790 [ 43.119769] kasan_report+0x23c/0x360 [ 43.123571] check_memory_region+0x137/0x190 [ 43.127975] kasan_check_write+0x14/0x20 [ 43.132035] skb_release_data+0x16a/0x790 [ 43.136184] ? refcount_inc_not_zero+0x280/0x280 2018/04/02 19:31:14 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000ee1fa8)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000b78ff0), 0x0) 2018/04/02 19:31:14 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xa, 0x200, 0x9392, 0x51, 0x0, 0x1}, 0x2c) 2018/04/02 19:31:14 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000ee1fa8)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000b78ff0), 0x0) [ 43.140938] ? kfree_skbmem+0xe2/0x1e0 [ 43.144825] ? skb_tx_error+0x2c0/0x2c0 [ 43.148799] ? sock_wfree+0xbc/0x140 [ 43.152515] ? sk_common_release+0x2f0/0x2f0 [ 43.156920] skb_release_all+0x4a/0x60 [ 43.160798] kfree_skb+0x16b/0x4c0 [ 43.164372] ? ip6_tnl_start_xmit+0x184/0x2070 [ 43.168949] ? __kfree_skb+0x20/0x20 [ 43.172661] ? packet_sendmsg+0x6020/0x6020 [ 43.176982] ? ___ratelimit+0x30d/0x630 [ 43.180965] ip6_tnl_start_xmit+0x184/0x2070 [ 43.185373] ? ip6_tnl_xmit+0x31c0/0x31c0 [ 43.189516] ? lock_downgrade+0x980/0x980 [ 43.193661] ? vprintk_func+0x5e/0xc0 [ 43.197457] ? kasan_check_read+0x11/0x20 [ 43.201603] ? rcu_is_watching+0x85/0x130 [ 43.205747] ? rcu_report_exp_cpu_mult+0x480/0x480 [ 43.210677] ? dev_queue_xmit_nit+0x9b0/0xc40 [ 43.215167] ? trace_hardirqs_off+0x10/0x10 [ 43.219487] ? dev_queue_xmit_nit+0x8af/0xc40 [ 43.223974] ? __packet_pick_tx_queue+0x70/0x70 [ 43.228643] ? __lock_is_held+0xb6/0x140 [ 43.232706] dev_hard_start_xmit+0x24e/0xac0 [ 43.237105] ? SYSC_sendto+0x361/0x5c0 2018/04/02 19:31:14 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000265ff7)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x227a, &(0x7f0000000000)) [ 43.240993] ? validate_xmit_skb_list+0x120/0x120 [ 43.245836] ? netif_skb_features+0x5ff/0x9b0 [ 43.250328] ? __skb_gso_segment+0x840/0x840 [ 43.254731] ? validate_xmit_xfrm+0xb8/0xda0 [ 43.259135] ? lock_acquire+0x1d5/0x580 [ 43.263103] ? __dev_queue_xmit+0x2fe/0x2fd0 [ 43.267511] ? validate_xmit_skb+0x512/0xb40 [ 43.271914] ? netif_skb_features+0x9b0/0x9b0 [ 43.276411] __dev_queue_xmit+0x26cf/0x2fd0 [ 43.280743] ? netdev_pick_tx+0x2c0/0x2c0 [ 43.284892] ? debug_check_no_locks_freed+0x3c0/0x3c0 2018/04/02 19:31:14 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000265ff7)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x227a, &(0x7f0000000000)) [ 43.290077] ? __sched_text_start+0x8/0x8 [ 43.294223] ? trace_hardirqs_off+0x10/0x10 [ 43.298536] ? plist_check_list+0xa0/0xa0 [ 43.302681] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 43.307866] ? kasan_check_read+0x11/0x20 [ 43.312006] ? refcount_add_not_zero+0x1c0/0x2b0 [ 43.316754] ? refcount_dec_if_one+0x170/0x170 [ 43.321327] ? alloc_skb_with_frags+0x468/0x750 [ 43.325999] ? refcount_add+0x24/0x60 [ 43.329801] ? skb_set_owner_w+0x232/0x330 [ 43.334026] ? sock_alloc_send_pskb+0x6e6/0x9e0 [ 43.338698] ? sock_wmalloc+0x1e0/0x1e0 [ 43.342674] ? dev_get_by_index+0xbf/0x170 [ 43.346907] ? lock_downgrade+0x980/0x980 [ 43.351056] ? cap_capable+0x1b5/0x230 [ 43.354940] ? security_capable+0x8e/0xc0 [ 43.359090] dev_queue_xmit+0x17/0x20 [ 43.362882] ? dev_queue_xmit+0x17/0x20 [ 43.366851] packet_sendmsg+0x3ad9/0x6020 [ 43.371002] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 43.376187] ? find_held_lock+0x35/0x1d0 [ 43.380255] ? futex_wait_queue_me+0x30/0x800 [ 43.384748] ? packet_cached_dev_get+0x2b0/0x2b0 [ 43.389500] ? rcu_is_watching+0x85/0x130 [ 43.393645] ? rcu_report_exp_cpu_mult+0x480/0x480 [ 43.398579] ? trace_hardirqs_off+0x10/0x10 [ 43.402896] ? iterate_fd+0x3f0/0x3f0 [ 43.406690] ? do_futex+0x86f/0x22a0 [ 43.410404] ? debug_mutex_init+0x1c/0x60 [ 43.414549] ? find_held_lock+0x35/0x1d0 [ 43.418610] ? __might_fault+0x110/0x1d0 [ 43.422667] ? lock_downgrade+0x980/0x980 [ 43.426817] ? lock_release+0xa40/0xa40 [ 43.430783] ? check_same_owner+0x320/0x320 [ 43.435109] ? __check_object_size+0x8b/0x530 [ 43.439610] ? security_socket_sendmsg+0x89/0xb0 [ 43.444359] ? packet_cached_dev_get+0x2b0/0x2b0 [ 43.449104] sock_sendmsg+0xca/0x110 [ 43.452795] SYSC_sendto+0x361/0x5c0 [ 43.456496] ? SYSC_connect+0x4a0/0x4a0 [ 43.460453] ? get_unused_fd_flags+0x190/0x190 [ 43.465014] ? alloc_file+0x27e/0x390 [ 43.468798] ? _raw_spin_unlock+0x22/0x30 [ 43.472921] ? sock_alloc_file+0x2a6/0x560 [ 43.477138] ? __alloc_fd+0x750/0x750 [ 43.480917] ? SyS_futex+0x269/0x390 [ 43.484603] ? fd_install+0x4d/0x60 [ 43.488217] ? do_futex+0x22a0/0x22a0 [ 43.492000] ? SyS_socket+0x12d/0x1d0 [ 43.495780] ? move_addr_to_kernel+0x60/0x60 [ 43.500166] SyS_sendto+0x40/0x50 [ 43.503603] ? SyS_getpeername+0x30/0x30 [ 43.507996] do_syscall_64+0x281/0x940 [ 43.511867] ? vmalloc_sync_all+0x30/0x30 [ 43.515992] ? _raw_spin_unlock_irq+0x27/0x70 [ 43.520465] ? finish_task_switch+0x1c1/0x810 [ 43.524936] ? syscall_return_slowpath+0x550/0x550 [ 43.529842] ? syscall_return_slowpath+0x2ac/0x550 [ 43.534747] ? prepare_exit_to_usermode+0x350/0x350 [ 43.539738] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 43.545082] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 43.549906] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 43.555075] RIP: 0033:0x4552d9 [ 43.558237] RSP: 002b:00007f399ee2dc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 43.565919] RAX: ffffffffffffffda RBX: 00007f399ee2e6d4 RCX: 00000000004552d9 [ 43.573162] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000015 [ 43.580407] RBP: 000000000072bea0 R08: 0000000020000180 R09: 000000000000001c [ 43.587651] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 43.594894] R13: 00000000000004f3 R14: 00000000006fa768 R15: 0000000000000000 [ 43.602145] [ 43.603745] Allocated by task 6302: [ 43.607352] save_stack+0x43/0xd0 [ 43.610790] kasan_kmalloc+0xad/0xe0 [ 43.614474] __kmalloc_node_track_caller+0x47/0x70 [ 43.619377] __kmalloc_reserve.isra.39+0x41/0xd0 [ 43.624103] __alloc_skb+0x12a/0x760 [ 43.627788] alloc_skb_with_frags+0x10d/0x750 [ 43.632264] sock_alloc_send_pskb+0x7b3/0x9e0 [ 43.636748] packet_sendmsg+0x1ed7/0x6020 [ 43.640867] sock_sendmsg+0xca/0x110 [ 43.644552] SYSC_sendto+0x361/0x5c0 [ 43.648239] SyS_sendto+0x40/0x50 [ 43.651665] do_syscall_64+0x281/0x940 [ 43.655528] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 43.660692] [ 43.662298] Freed by task 6302: [ 43.665552] save_stack+0x43/0xd0 [ 43.668977] __kasan_slab_free+0x11a/0x170 [ 43.673184] kasan_slab_free+0xe/0x10 [ 43.676962] kfree+0xd9/0x260 [ 43.680048] skb_free_head+0x74/0xb0 [ 43.683734] skb_release_data+0x5c1/0x790 [ 43.687874] skb_release_all+0x4a/0x60 [ 43.691740] consume_skb+0x160/0x490 [ 43.695428] packet_rcv+0x15b/0x17a0 [ 43.699113] dev_queue_xmit_nit+0x866/0xc40 [ 43.703408] dev_hard_start_xmit+0x16b/0xac0 [ 43.707796] __dev_queue_xmit+0x26cf/0x2fd0 [ 43.712088] dev_queue_xmit+0x17/0x20 [ 43.715870] packet_sendmsg+0x3ad9/0x6020 [ 43.719991] sock_sendmsg+0xca/0x110 [ 43.723678] SYSC_sendto+0x361/0x5c0 [ 43.727367] SyS_sendto+0x40/0x50 [ 43.730798] do_syscall_64+0x281/0x940 [ 43.734659] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 43.739816] [ 43.741418] The buggy address belongs to the object at ffff8801c71eb080 [ 43.741418] which belongs to the cache kmalloc-512 of size 512 [ 43.754048] The buggy address is located 224 bytes inside of [ 43.754048] 512-byte region [ffff8801c71eb080, ffff8801c71eb280) [ 43.765892] The buggy address belongs to the page: [ 43.770797] page:ffffea00071c7ac0 count:1 mapcount:0 mapping:ffff8801c71eb080 index:0xffff8801c71eb580 [ 43.780212] flags: 0x2fffc0000000100(slab) [ 43.784422] raw: 02fffc0000000100 ffff8801c71eb080 ffff8801c71eb580 0000000100000004 [ 43.792284] raw: ffffea00071cd0a0 ffffea00071efda0 ffff8801dac00940 0000000000000000 [ 43.800139] page dumped because: kasan: bad access detected [ 43.805827] [ 43.807428] Memory state around the buggy address: [ 43.812335] ffff8801c71eb000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 43.819666] ffff8801c71eb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.826996] >ffff8801c71eb100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.834340] ^ [ 43.840803] ffff8801c71eb180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.848137] ffff8801c71eb200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 43.855467] ================================================================== [ 43.862794] Disabling lock debugging due to kernel taint [ 43.868260] Kernel panic - not syncing: panic_on_warn set ... [ 43.868260] [ 43.875615] CPU: 0 PID: 6302 Comm: syz-executor2 Tainted: G B 4.16.0+ #11 [ 43.883743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.893093] Call Trace: [ 43.895677] dump_stack+0x1a7/0x27d [ 43.899289] ? arch_local_irq_restore+0x53/0x53 [ 43.903935] ? kasan_end_report+0x32/0x50 [ 43.908054] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 43.912789] ? vsnprintf+0x1ed/0x1900 [ 43.916563] ? skb_release_data+0x120/0x790 [ 43.920855] panic+0x1f8/0x42c [ 43.924024] ? refcount_error_report+0x214/0x214 [ 43.928769] ? do_raw_spin_unlock+0x9e/0x310 [ 43.933155] ? do_raw_spin_unlock+0x9e/0x310 [ 43.937544] ? skb_release_data+0x16a/0x790 [ 43.941846] kasan_end_report+0x50/0x50 [ 43.945792] kasan_report+0x149/0x360 [ 43.949567] check_memory_region+0x137/0x190 [ 43.953946] kasan_check_write+0x14/0x20 [ 43.957984] skb_release_data+0x16a/0x790 [ 43.962109] ? refcount_inc_not_zero+0x280/0x280 [ 43.966835] ? kfree_skbmem+0xe2/0x1e0 [ 43.970694] ? skb_tx_error+0x2c0/0x2c0 [ 43.974640] ? sock_wfree+0xbc/0x140 [ 43.978324] ? sk_common_release+0x2f0/0x2f0 [ 43.982704] skb_release_all+0x4a/0x60 [ 43.986563] kfree_skb+0x16b/0x4c0 [ 43.990076] ? ip6_tnl_start_xmit+0x184/0x2070 [ 43.994628] ? __kfree_skb+0x20/0x20 [ 43.998318] ? packet_sendmsg+0x6020/0x6020 [ 44.002611] ? ___ratelimit+0x30d/0x630 [ 44.006559] ip6_tnl_start_xmit+0x184/0x2070 [ 44.010935] ? ip6_tnl_xmit+0x31c0/0x31c0 [ 44.015057] ? lock_downgrade+0x980/0x980 [ 44.019176] ? vprintk_func+0x5e/0xc0 [ 44.022947] ? kasan_check_read+0x11/0x20 [ 44.027065] ? rcu_is_watching+0x85/0x130 [ 44.031183] ? rcu_report_exp_cpu_mult+0x480/0x480 [ 44.036096] ? dev_queue_xmit_nit+0x9b0/0xc40 [ 44.040562] ? trace_hardirqs_off+0x10/0x10 [ 44.044853] ? dev_queue_xmit_nit+0x8af/0xc40 [ 44.049320] ? __packet_pick_tx_queue+0x70/0x70 [ 44.053967] ? __lock_is_held+0xb6/0x140 [ 44.058000] dev_hard_start_xmit+0x24e/0xac0 [ 44.062382] ? SYSC_sendto+0x361/0x5c0 [ 44.066242] ? validate_xmit_skb_list+0x120/0x120 [ 44.071057] ? netif_skb_features+0x5ff/0x9b0 [ 44.075523] ? __skb_gso_segment+0x840/0x840 [ 44.079901] ? validate_xmit_xfrm+0xb8/0xda0 [ 44.084279] ? lock_acquire+0x1d5/0x580 [ 44.088221] ? __dev_queue_xmit+0x2fe/0x2fd0 [ 44.092599] ? validate_xmit_skb+0x512/0xb40 [ 44.096977] ? netif_skb_features+0x9b0/0x9b0 [ 44.101444] __dev_queue_xmit+0x26cf/0x2fd0 [ 44.105741] ? netdev_pick_tx+0x2c0/0x2c0 [ 44.109858] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 44.115023] ? __sched_text_start+0x8/0x8 [ 44.119141] ? trace_hardirqs_off+0x10/0x10 [ 44.123430] ? plist_check_list+0xa0/0xa0 [ 44.127549] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 44.132709] ? kasan_check_read+0x11/0x20 [ 44.136832] ? refcount_add_not_zero+0x1c0/0x2b0 [ 44.141556] ? refcount_dec_if_one+0x170/0x170 [ 44.146105] ? alloc_skb_with_frags+0x468/0x750 [ 44.150746] ? refcount_add+0x24/0x60 [ 44.154516] ? skb_set_owner_w+0x232/0x330 [ 44.158719] ? sock_alloc_send_pskb+0x6e6/0x9e0 [ 44.163363] ? sock_wmalloc+0x1e0/0x1e0 [ 44.167309] ? dev_get_by_index+0xbf/0x170 [ 44.171517] ? lock_downgrade+0x980/0x980 [ 44.175639] ? cap_capable+0x1b5/0x230 [ 44.179499] ? security_capable+0x8e/0xc0 [ 44.183619] dev_queue_xmit+0x17/0x20 [ 44.187391] ? dev_queue_xmit+0x17/0x20 [ 44.191338] packet_sendmsg+0x3ad9/0x6020 [ 44.195459] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 44.200628] ? find_held_lock+0x35/0x1d0 [ 44.204661] ? futex_wait_queue_me+0x30/0x800 [ 44.209126] ? packet_cached_dev_get+0x2b0/0x2b0 [ 44.213851] ? rcu_is_watching+0x85/0x130 [ 44.217969] ? rcu_report_exp_cpu_mult+0x480/0x480 [ 44.222870] ? trace_hardirqs_off+0x10/0x10 [ 44.227164] ? iterate_fd+0x3f0/0x3f0 [ 44.230935] ? do_futex+0x86f/0x22a0 [ 44.234619] ? debug_mutex_init+0x1c/0x60 [ 44.238736] ? find_held_lock+0x35/0x1d0 [ 44.242766] ? __might_fault+0x110/0x1d0 [ 44.246796] ? lock_downgrade+0x980/0x980 [ 44.250915] ? lock_release+0xa40/0xa40 [ 44.254859] ? check_same_owner+0x320/0x320 [ 44.259154] ? __check_object_size+0x8b/0x530 [ 44.263623] ? security_socket_sendmsg+0x89/0xb0 [ 44.268348] ? packet_cached_dev_get+0x2b0/0x2b0 [ 44.273073] sock_sendmsg+0xca/0x110 [ 44.276757] SYSC_sendto+0x361/0x5c0 [ 44.280438] ? SYSC_connect+0x4a0/0x4a0 [ 44.284382] ? get_unused_fd_flags+0x190/0x190 [ 44.288935] ? alloc_file+0x27e/0x390 [ 44.292705] ? _raw_spin_unlock+0x22/0x30 [ 44.296825] ? sock_alloc_file+0x2a6/0x560 [ 44.301034] ? __alloc_fd+0x750/0x750 [ 44.304807] ? SyS_futex+0x269/0x390 [ 44.308488] ? fd_install+0x4d/0x60 [ 44.312086] ? do_futex+0x22a0/0x22a0 [ 44.315856] ? SyS_socket+0x12d/0x1d0 [ 44.319627] ? move_addr_to_kernel+0x60/0x60 [ 44.324005] SyS_sendto+0x40/0x50 [ 44.327433] ? SyS_getpeername+0x30/0x30 [ 44.331467] do_syscall_64+0x281/0x940 [ 44.335326] ? vmalloc_sync_all+0x30/0x30 [ 44.339454] ? _raw_spin_unlock_irq+0x27/0x70 [ 44.343929] ? finish_task_switch+0x1c1/0x810 [ 44.348397] ? syscall_return_slowpath+0x550/0x550 [ 44.353298] ? syscall_return_slowpath+0x2ac/0x550 [ 44.358195] ? prepare_exit_to_usermode+0x350/0x350 [ 44.363180] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 [ 44.368514] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 44.373328] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 44.378488] RIP: 0033:0x4552d9 [ 44.381648] RSP: 002b:00007f399ee2dc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 44.389326] RAX: ffffffffffffffda RBX: 00007f399ee2e6d4 RCX: 00000000004552d9 [ 44.396565] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000015 [ 44.403806] RBP: 000000000072bea0 R08: 0000000020000180 R09: 000000000000001c [ 44.411047] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 44.418285] R13: 00000000000004f3 R14: 00000000006fa768 R15: 0000000000000000 [ 44.426039] Dumping ftrace buffer: [ 44.429560] (ftrace buffer empty) [ 44.433238] Kernel Offset: disabled [ 44.436834] Rebooting in 86400 seconds..